cypress/included:13.9.0 does not include curl

[JonasArcayo]

I'm getting curl command not found in bitbucket pipeline using the cypress included 13.9

[jennifer-shehane]

The 13.9.0 tag includes curl, you can see here: https://hub.docker.com/layers/cypress/included/13.9.0/images/sha256-544ae92b1c614fcf8a118912301d897c4de6887b45f7daa00d67d29c5bedb812?context=explore

[MikeMcC399]

@jennifer-shehane

curl is not found in this image:

docker pull cypress/included:13.9.0
docker run -it --entrypoint /bin/bash cypress/included:13.9.0
whereis curl
curl:

It seems that curl is first installed, then removed:

cypress-docker-images/factory/factory.Dockerfile

Lines 31 to 48 in b952572

	RUN ls -la /root \
	&& chmod 777 /root \
	&& apt-get update \
	&& apt-get install --no-install-recommends -y \
	# Always install: Needed to run Cypress
	xvfb \
	libglib2.0-0 \
	libnss3 \
	libatk1.0-0 \
	libatk-bridge2.0-0 \
	libcups2 \
	libgtk-3-0 \
	libgbm1 \
	libasound2 \
	# Needed to support the ps command, while not used by cypress directly it is used by some of our examples and the dependency is small (~1mb).
	procps \
	# Needed to support curl, similar to ps, it's not directly used by cypress but leaving it in the container is practically free.
	curl \

cypress-docker-images/factory/factory.Dockerfile

Lines 119 to 124 in b952572

	# Global Cleanup
	ONBUILD RUN apt-get purge -y --auto-remove \
	curl \
	bzip2 \
	gnupg \
	dirmngr\

• The removal was initiated through PR security: remove critical vulnerabilities #855

Edit: Debian security tracker for curl

[JonasArcayo]

Cypress base 20.13.0 has the same thing, curl not found.

[MikeMcC399]

@JonasArcayo

Cypress base 20.13.0 has the same thing, curl not found.

The reason is the same. See #1049 (comment) above.

[MikeMcC399]

[jennifer-shehane]

I do remember this now. This was intentional and we did not intend to add curl due to security reasons.